PRIVACY AND COOKIES POLICY
1. Personal data controller
The controller of the personal data of website users is Elaboracja Niewiadów sp. z o.o., with its registered office at Osiedle Niewiadów 49, 97-225 Osiedle Niewiadów, Poland (the “Controller”).
The Controller has appointed a Data Protection Officer, who can be contacted at: rodo@eniewiadow.pl
2. Scope of data processing when using the Website
The Website provides information and a contact form. It does not offer user accounts, newsletter subscriptions or the submission of job application documents.
When you use the Website, technical information about your device and connection may nevertheless be processed automatically. This may include your IP address, the date and time of the connection, the address of the requested resource, information about your browser and operating system, and other information recorded in server logs.
These data are processed to:
- ensure that the Website operates correctly and securely;
- diagnose errors and maintain the security of IT systems;
- prevent abuse and unauthorised use of the Website.
The legal basis for this processing is the Controller’s legitimate interest in ensuring the security and proper operation of the Website — Article 6(1)(f) of the General Data Protection Regulation (GDPR).
3. Contacting the Controller
You can contact the Controller using the Website’s contact form, by email or by telephone.
When you contact us, the data you provide in the form, message or conversation are processed to handle correspondence and respond to your enquiry. The form includes your full name, email address, optional company name and message. Messages submitted through the form are stored in WordPress and are accessible to persons authorised by the Controller.
The legal bases for this processing are:
- Article 6(1)(f) GDPR — the Controller’s legitimate interest in handling correspondence and responding to enquiries;
- Article 6(1)(b) GDPR — where the contact relates to entering into or performing a contract.
Providing data is voluntary. However, your full name, email address and message are required to submit the form. Providing a company name is optional. Acknowledging that you have read this Policy does not constitute consent to marketing. Data may be necessary to respond or take steps at the request of the person contacting the Controller.
4. Cookies and similar technologies
The Website uses technical mechanisms to operate correctly and protect the contact form. In the current version, the public part of the Website does not activate its own analytics or marketing cookies. The external Google Maps component is loaded only when a user deliberately enables it.
The technologies used in the current version of the Website are described below.
Necessary mechanisms and security
Navigation and language selection do not require preferences to be stored in cookies. The form uses a security token, an anti-spam field and a temporary submission rate limit. This limit uses a hash of the IP address stored on the server for 60 seconds; it is not stored on the user’s device.
The WordPress administration panel uses technical cookies for the sign-in and settings of authorised users. They are not used to track people browsing the public part of the Website. Technologies necessary to provide a service requested by the user do not require prior consent.
Analytics and marketing cookies
No analytics or marketing tools are activated in the current version of the Website. Any future introduction of such tools will require this Policy to be updated beforehand and user consent to be obtained where required by applicable law.
LinkedIn Insight Tag
LinkedIn Insight Tag is not currently activated on the Website. If introduced, it will be activated only after the required user consent has been obtained.
Google Maps and managing consent
A Google Maps component is available on the contact page. Until you enable it, the Website does not load the embedded map or connect to Google through it. Clicking “Accept and load the map” gives consent to load the external component. Google may then receive information such as your IP address and browser details and use its own cookies and similar technologies in accordance with its policies. The legal basis for the processing associated with loading the map through the Website is Article 6(1)(a) GDPR. Consent applies to the current page view and is not stored in cookies or local storage. You can withdraw it by clicking “Disable the map and withdraw consent” or reloading the page. Withdrawal does not affect the lawfulness of earlier processing and does not automatically delete cookies stored by Google; these can be managed in your browser settings. Alternatively, you can use the link that opens the map directly on Google’s website.
5. Technologies in use
This overview reflects the Website’s current configuration. The scope and duration of Google technologies may depend on the user’s browser and Google account settings. Further details are provided in Google’s privacy policy and cookies information.
| Technology | Provider | Purpose and category | Duration |
|---|---|---|---|
| Contact form protection | Controller / WordPress | Necessary: form token, anti-spam mechanisms and a submission rate limit. These do not store user cookies. | Submission rate limit: 60 seconds on the server. Token validity follows the WordPress security mechanism. |
| WordPress administration cookies | Controller / WordPress | Necessary: authentication and settings of authorised administration users. | Session or the expiry of the particular cookie, depending on sign-in settings; applies to the administration panel. |
| Embedded Google Maps and Google technologies | Google Ireland Limited | External functional component; loaded after consent. Google may use its own cookies. | Map: until disabled or the page is reloaded. Any Google cookies: as described by the provider and depending on user settings. |
| Analytics, marketing and LinkedIn Insight Tag | — | Not currently activated on the Website. | Not applicable. |
Google Privacy Policy · Google cookies information
6. Data recipients
Personal data may be disclosed to entities supporting the Controller in maintaining and operating the Website, in particular:
- the hosting provider;
- the entity responsible for maintaining or technically supporting the Website;
- persons with authorised administrative access to the Website;
- providers of analytics, marketing tools or external components — only to the extent resulting from tools actually used and, where required, after user consent has been obtained.
Entities processing data on behalf of the Controller do so under appropriate data processing agreements where required by the nature of the cooperation.
7. Transfers of data outside the European Economic Area
Using the external Google Maps component after enabling it may involve data being processed outside the European Economic Area. Information about Google’s processing practices, international transfers and safeguards is available in Google’s privacy policy. If other external services are introduced, the Controller will provide the required information about transfers and ensure that appropriate transfer mechanisms are in place where required.
8. Data retention
Data in the Website’s technical logs are retained for the period necessary to ensure the Website’s security and proper operation.
Data processed in connection with correspondence are retained for the period necessary to handle the enquiry and subsequently for the period necessary to establish, exercise or defend legal claims.
Data processed on the basis of consent are processed until consent is withdrawn, the purpose of processing is no longer relevant, or the relevant tool is no longer used, whichever occurs first.
9. Rights of data subjects
Subject to the conditions set out in the GDPR, a data subject may have the right to:
- access their data;
- have their data rectified;
- have their data erased;
- restrict processing;
- data portability — where the conditions specified in the GDPR apply;
- object to processing based on Article 6(1)(f) GDPR;
- withdraw consent at any time — where processing is based on consent.
Data subjects also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).
10. Automated decision-making
The Controller does not make decisions about Website users based solely on automated processing of personal data that produce legal effects concerning them or similarly significantly affect them.
11. Changes to this Policy
This Policy may be updated, in particular if the way the Website operates changes, new tools or technologies are introduced, or applicable legal requirements change.
The current version of this Policy will be available on the Website.
Published: 6 November 2026